Identity and Access Management Release Notes

Release notes for authentication, single sign-on, multi-factor authentication, and identity management tools.

Get this feed:

Products (7)

Latest Identity and Access Management Updates

Nov 11, 2026
Date parsed from source:
Nov 11, 2026

First seen by Releasebot:
Nov 11, 2026
keycloak by Keycloak

nightly

keycloak checks whether providers implement OnUserCache for the user model.

Check if provider implements OnUserCache for the user model

Closes #54410

Signed-off-by: Dmitry Repchevsky <[email protected]&gt
Original source
Nov 10, 2026
Date parsed from source:
Nov 10, 2026

First seen by Releasebot:
Nov 11, 2026
WorkOS

Token exchange for WorkOS Connect

WorkOS adds support for exchanging access tokens under RFC 8693.

Exchange access tokens under RFC 8693
Original source
All of your release notes in one feed

Join Releasebot and get updates from Keycloak and hundreds of other software products.

Create account
Get updates with:
Nov 10, 2026
Date parsed from source:
Nov 10, 2026

First seen by Releasebot:
Nov 11, 2026
Auth0

Node.js 18 Extensibility Runtime

Auth0 is phasing out the Node.js 18 extensibility runtime, with selection becoming unavailable progressively and end of life starting after May 10, 2027. Customers should migrate extensibility features and Actions to a newer runtime.

The Node.js 18 extensibility runtime will progressively become unavailable for selection, starting with tenants that no longer actively use it. This deprecation affects all extensibility features, including Actions, Custom Database Connections, Custom Social Connections, Rules, and Hooks.

Before the grace period ends on May 10, 2027, update your tenant’s default Runtime setting, as well as manually update the runtime for any individual Action still executing on Node.js 18.

Extensibility that remains unmigrated and targets the Node.js 18 runtime will eventually be forced to run on a newer runtime. In addition, any Actions-based Marketplace integrations that depend on the Node.js 18 runtime, and for which the third-party owner or author does not provide an updated version targeting a newer runtime, may become unsupported.

After the grace period ends, Auth0 will begin the end-of-life phase for the Node.js 18 extensibility runtime, culminating in its complete removal.

For more information, check our docs.
Original source
Nov 9, 2026
Date parsed from source:
Nov 9, 2026

First seen by Releasebot:
Nov 11, 2026
Okta Identity Engine by Okta

2026.45.1

Okta Identity Engine adds support for newer Android and Windows versions, staged AI agent imports, and clearer Salesforce agent versioning. The release also updates provisioning and RADIUS agents, fixes sign-in and admin issues, and expands Okta Integration Network support.
Generally Available Features

Device assurance OS version update

The following OS versions are now supported in device assurance policies:

Android 14-17 patch level 2026-10-01

Windows 10 26H2 10.0.26300.9550

Versioning for imported Salesforce AI agents

Now when you import an AI agent from Salesforce, it displays its latest active version. If no active version is available, it displays the latest published inactive version. See AI agent imports.

Okta Provisioning Agent, version 3.3.2

Okta Provisioning Agent 3.3.2 is now available. This release removes root certificate authorities (CAs) that Okta no longer trusts from the agent trust store and updates the bundled Amazon Corretto JRE to 17.0.21.0.10. The change applies to the RPM and the Windows installer. See Okta Provisioning Agent and SDK version history.

Import staged AI agents

You can now import AI agents that are in a staged or preview state.

Radius Agent version 2.29

This version includes updates and fixes. See Okta RADIUS Server agent version history.

Fixes

Users who skipped passkey enrollment during an authenticator enrollment grace period were redirected to the Okta End-User Dashboard instead of their configured app on subsequent sign-ins. (OKTA-1237318)

In orgs with app branding migration enabled, apps using the Classic Engine authentication pipeline appeared in the Access Testing Tool. (OKTA-1271513)

The Suspicious App Access detection could be fired again almost immediately after being triggered. (OKTA-1281669)

The System Log didn't record an event when per-app authentication pipeline settings in an org were removed in bulk, such as during an Identity Engine rollback. (OKTA-1281859)

For orgs that migrated from Classic Engine to Identity Engine and used WebAuthn, the Passkey settings page incorrectly displayed the authenticator name as Passkeys instead of Security Key or Biometric (what end users see during enrollment or authentication). (OKTA-1288588)

Authenticator enrollment policies that use authenticator sets didn't include the text explaining that the temporary access code (TAC) authenticator isn't available for user enrollment. (OKTA-1289777)

In Identity Engine orgs with a custom domain and custom sign-in page, opening a /signin/ URL with no dedicated route (such as /signin/okta) caused the Sign-In Widget to call the Classic Engine API instead of the Identity Engine API. (OKTA-1293866)

The Machine Assignments tab was unavailable in Okta Org2Org integrations, which prevented admins from configuring Cross App Access. (OKTA-1294022)

HERMIT_VPN wasn't supported as an IP service category in enhanced dynamic zones. (OKTA-1295010)

In orgs that use app branding migration, device platform conditions in app sign-on policy rules were migrated from Classic Engine to Identity Engine inconsistently depending on the selected platforms. (OKTA-1313619)

Users without the super admin role could modify the URL for a Secure Password Store app instance, such as one created from the SWA Template app. (OKTA-1314535)

In orgs with custom domains, signing out of the Admin Console didn't invalidate the Okta Dashboard session. (OKTA-1314683)

Okta Integration Network

ANSI Standards Connect (SAML) is now available. Learn more.

Datatrac Web (OIDC) is now available. Learn more.

Datatrac Web (Universal Logout) is now available. Learn more.

Dropbox Business now supports XAA.

Miro (formerly RealtimeBoard) now supports XAA.

Modal (SCIM) is now available. Learn more.

Monday.com (XAA) is now available.

Rogue Security (API Service) is now available. Learn more.

Rubrik Security Cloud now has the following scopes:

okta.deviceAssurance.manage

okta.deviceAssurance.read

okta.linkedObjects.manage

okta.linkedObjects.read

okta.threatInsights.manage

okta.threatInsights.read

okta.authenticators.manage

okta.authenticators.read

okta.behaviors.manage

okta.behaviors.read

StatusDrift.com (SAML) is now available. Learn more.

StatusDrift.com (Universal Logout) is now available. Learn more.

VeriKnox (OIDC) is now available. Learn more.

WOVN.io (SAML) updated its SSO URL.

X (Twitter) (SWA) was updated.

Zoom now supports XAA.

Original source
Nov 9, 2026
Date parsed from source:
Nov 9, 2026

First seen by Releasebot:
Nov 10, 2026
Auth0

Management API Search for Clients, Client Grants, Resource Servers and Organizations is now in Early Access

Auth0 adds Early Access search endpoints for Management API clients, client grants, resource servers, and organizations, making it easier to find specific resources without paging through full lists or filtering client-side. The endpoints are available in Public Cloud and many Private Cloud environments.

We're excited to announce that search endpoints for the Management API for Clients, Client Grants, Resource Servers and Organizations are now available in Early Access! Find a specific resource without paging through full lists or filtering client-side.

Available in Public Cloud and many Private Cloud environments, with the remaining environments rolling out in the coming weeks.

To learn more, see the documentation for Clients, Client Grants, Resource Servers and Organizations.
Original source
Nov 9, 2026
Date parsed from source:
Nov 9, 2026

First seen by Releasebot:
Nov 10, 2026
Auth0

Dashboard Search is now GA!

Auth0 makes Dashboard Search generally available, helping customers find applications, APIs, users, and other resources faster with guided filters, Boolean search, and global search from the Command Palette. Filtered views can be shared or bookmarked, with public cloud availability and a gradual private cloud rollout.
Dashboard Search is now Generally Available! Find the resources you need faster, without scrolling through paginated lists.

What's Included

Guided filters and Boolean search in the search bar of:

Applications

APIs

Roles

Custom Domains

Organizations

Organization members

Enterprise Connections

Database Connections

Global Search in the Command Palette (Cmd+K on macOS, Ctrl+K on Windows/Linux), to search Applications, APIs, Organizations, and Users by name, display name, or ID from any Dashboard page.

How It Works

Navigate to any of the sections above and use the search bar to build filters. Combine up to 5 filters simultaneously with AND/OR logic. Filter pills persist in the URL so you can share or bookmark filtered views. Metadata can be searched by key and value or by key only, and you can use NOT to exclude results.

This update is available to all customers in public cloud, and will be gradually rolling out to private cloud environments in the coming weeks.

For detailed documentation on search capabilities, visit our Product documentation.
Original source
Nov 9, 2026
Date parsed from source:
Nov 9, 2026

First seen by Releasebot:
Nov 10, 2026
Auth0

Auth for UCP is now in Early Access

Auth0 releases Auth for UCP in limited Early Access, helping businesses secure Universal Commerce Protocol servers and let shoppers link AI agent identities to business accounts for personalization, loyalty points, and order tracking.
We’re excited to announce that Auth for UCP is now available in limited Early Access. Auth0 can now secure Universal Commerce Protocol (UCP) servers and let shoppers link their identity in an AI agent to their account with a business.

UCP is an open standard that lets AI agents discover a business’s catalog and make purchases on a user’s behalf. With Auth for UCP, you can:

Secure your UCP server with Auth0 so that trusted agents, such as Gemini, can connect to it.

Link accounts so a user can connect their identity in Gemini to their account with your business, enabling personalization, loyalty points, and order tracking.

Coming next: support for Google streamlined identity linking, which lets users who are signed in to Gemini with the same Google account they used to sign up with your business link their accounts without re-entering their login information.

To learn more, read the Auth for UCP documentation and our blog posts Securing Agentic Commerce with UCP and Securing the front door of Agentic Commerce.
Original source
Nov 7, 2026
Date parsed from source:
Nov 7, 2026

First seen by Releasebot:
Nov 8, 2026
keycloak by Keycloak

nightly

keycloak makes the OIDC identity provider broker nonce parameter publicly accessible.

Make OIDCIdentityProvider.BROKER_NONCE_PARAM public

Closes #54740

Signed-off-by: Maximilian Brodda <[email protected]>

Co-authored-by: Maximilian Brodda <[email protected]>
Original source
Nov 5, 2026
Date parsed from source:
Nov 5, 2026

First seen by Releasebot:
Nov 6, 2026
keycloak by Keycloak

26.8.2

keycloak releases a security-focused update addressing numerous vulnerabilities across authentication, tokens, SAML, and account management, alongside bug fixes and a Quarkus upgrade.
Upgrading

Before upgrading refer to the migration guide for a complete list of changes.

All resolved issues

Security fixes

#53061 [CVE-2026-92358] Cross-browser fallback proof survives successful account linking and self-service unlink organizations

#53618 [CVE-2026-105305] Device Authorization Grant bypasses per-client minimum.acr.value enforcement authentication

#53749 CVE-2026-107623: OIDC DCR read-modify-write silently disables offline token revocation on backchannel logout oidc

#53813 [CVE-2026-107889] Stored XSS on the login page via kcSanitize bypass authentication

#54333 [CVE-2026-111497] Out-of-bounds write in bundled Brotli decoder dist/quarkus

#54687 [CVE-2026-112201] Login-failure upsert trusts MySQL/MariaDB affected-row count

#54688 [CVE-2026-112208] Account takeover via stale SSO_AUTH note in Organization identity-first login (reproduced on 26.8.1)

#54689 [CVE-2026-110932] Keycloak <= 26.8.0 : Unauthenticated persistent disk exhaustion (theme gzip cache)

#54690 [CVE-2026-107123] Unauthenticated DoS in Keycloak SAML endpoint

#54691 [CVE-2026-107124] Session takeover by victim logout with injected id_token_hint

#54692 [CVE-2026-107602] Unauthenticated CPU and worker-pool exhaustion (restart required) via SAML 1.1 KeyInfo parser loop on a legal ds:KeyName

#54693 [CVE-2026-110931] Unauthenticated single-request JVM termination (OutOfMemoryError) via SAML 1.1 AuthorityBinding parser loop, incomplete fix of CVE-2026-7307

#54694 [CVE-2026-97367] DCR azp+sid claim substitution via User Property mappers allows Account REST victim session takeover — #YWH-PGM40475-313

#54695 [CVE-2026-97174] CIBA sub parameter injection causes attacker authentication to issue victim tokens — #YWH-PGM40475-289

#54696 [CVE-2026-114232] UMA user-managed permission resourceType field not validated — cross-owner resource access — #YWH-PGM40475-306

#54697 [CVE-2026-97847] Client manager can replace a sessionless token principal and take over the realm — #YWH-PGM40475-292

#54698 [CVE-2026-96547] DCR registration-time claim-path gap: attribute mappers forge realm_access.roles from user-editable fields

#54699 [CVE-2026-96457] Group-admin DENY bypass via top-level move (GroupsResource, CVE-2026-9099 regression)

#54700 [CVE-2026-96460] Token from token exchange can have unlimited expiration

#54701 [CVE-2026-97848] [SECURITY] Protocol mapper with jsonType=JSON bypasses CVE-2026-16102 fix — duplicate resource_access claim in access token; forged resource_access in ID token, userinfo and introspection response

#54702 [CVE-2026-109081] Principal with only create-client can inject a role into the realm default-roles — #YWH-PGM40475-290

#54703 [CVE-2026-93998] SAML adapter accepts assertions from the wrong configured issuer

#54704 [CVE-2026-96453] kcadm custom truststores trust arbitrary self-signed certificates

#54705 [CVE-2026-92857] Identity spoofing: a default-allowed DCR protocol mapper writes the reserved sub and aud claims

#54706 [CVE-2026-103112] Account Takeover via Authentication Race

#54707 [CVE-2026-97175] Unverified IdP email auto-linking enables account takeover

#54708 [CVE-2026-96447] Stateless token preferred_username fallback enables identity rebinding after client recreation

#54709 [CVE-2026-82965] SAML SOAP endpoint DoS via unbounded XML parsing on /realms/{realm}/protocol/saml/resolve

#54710 [CVE-2026-96448] FGAP v2 composite-blind role mapping lets manage-users assign a wrapper containing realm-admin — #YWH-PGM40475-256

#54711 [CVE-2026-92855] Keycloak SAML Broker Accepts Holder-of-Key Assertions Without Proof of Key Possession

#54712 [CVE-2026-92856] Keycloak SAML Identity Broker Ignores ProxyRestriction, Allowing Forbidden Downstream Assertion Issuance

#54713 [CVE-2026-19688] Admin API missing audience check

#54714 [CVE-2026-117691] SAML redirect binding signature bypass via percent-encoded parameter name (%53AMLResponse) — broker login as any user

Weaknesses

#50917 Realm client-session stats disclose hidden clients under FGAP v2 admin/fine-grained-permissions

#52104 JWE key-management algorithm not validated against provisioned key algorithm on request object decryption oidc

#53210 Harden PathMatcher URI normalization for leading dot segments and authority-less schemes authorization-services

#53535 SAML SLO: unsigned client can impersonate victim SP via spoofed Issuer on back-channel SessionIndex logout saml

#53815 Unverified broker email can satisfy an organization domain gate identity-brokering

Enhancements

#54184 Upgrade to Quarkus 3.40.1.1 dist/quarkus

Bugs

#44474 Keycloak Maximum Concurrent Session Limit is incorrectly registered as a login failure, triggering Keycloak's Brute Force protection authentication

#51630 FGAP V2: isInternal denylist missing admin-permissions client allows delegated admin to update it admin/fine-grained-permissions

#52870 Realm import: JSON representation migration fails with LazyInitializationException when a users file is present (regression in 26.3) import-export

#52968 Much open UDP Sockets after some Time core

#53238 Theme resources intermittently 404 on a cold gzip cache: GzipResourceEncodingProvider replaces the cached file non-atomically core

#53507 Enhancement request suggestion in downstream documentation docs

#53510 Github discussion reference should only be upstream docs

#53612 BCFIPS imports only the first certificate from a multi-certificate PEM trust bundle core

#53634 IdentityBrokerService fires duplicate error events and reflects user input in responses identity-brokering

#53760 Concurreny issue in JAXPValidationUtil saml

#53804 Operator Helm chart renders null version labels because Chart.yaml lacks appVersioN operator

#53809 ISPN000427 timeout on distributed caches when entry lock is contended during topology change infinispan

#53819 Links to keycloak.org in downstream docs

#53834 Flaky test: Admin UI E2E "should handle OID4VC section visibility based on feature flag" admin/ui

#53898 Original exception is swallowed by NullPointerException when acquiring the database lock fails storage

#53901 NullPointerException in KeycloakLogFilter after failed startup as the Profile is no longer initialized dist/quarkus

#53930 Periodic user storage sync runs at twice the configured period when a sync takes longer than ~1 second core

#53999 Validate keycloak locale before setting to KEYCLOAK_LOCALE Cookie authentication

#54173 Upgrade playwright for JS tests testsuite

#54398 FIPS tests failing: Could not transfer artifact / Could not generate keypair for algorithm: X25519MLKEM768 ci

Original source
Nov 5, 2026
Date parsed from source:
Nov 5, 2026

First seen by Releasebot:
Nov 6, 2026
keycloak by Keycloak

nightly

keycloak caches group lookups and paths per request to improve group access performance.

Cache getGroupByName and group paths per request

Closes #54179

Signed-off-by: Pedro Igor <[email protected]>
Original source

Identity and Access Management Release Notes

Products (7)

Latest Identity and Access Management Updates

nightly

Check if provider implements OnUserCache for the user model

Token exchange for WorkOS Connect

Node.js 18 Extensibility Runtime

2026.45.1

Generally Available Features

Device assurance OS version update

Versioning for imported Salesforce AI agents

Okta Provisioning Agent, version 3.3.2

Import staged AI agents

Radius Agent version 2.29

Fixes

Okta Integration Network

Management API Search for Clients, Client Grants, Resource Servers and Organizations is now in Early Access

Dashboard Search is now GA!

What's Included

How It Works

Auth for UCP is now in Early Access

nightly

Make OIDCIdentityProvider.BROKER_NONCE_PARAM public

26.8.2

Upgrading

All resolved issues

Security fixes

Weaknesses

Enhancements

Bugs

nightly

Cache getGroupByName and group paths per request